diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 81b475669997..22f5178de112 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11511,6 +11511,12 @@
     githubId = 3737;
     name = "Peter Jones";
   };
+  phip1611 = {
+    email = "phip1611@gmail.com";
+    github = "phip1611";
+    githubId = 5737016;
+    name = "Philipp Schuster";
+  };
   pkharvey = {
     email = "kayharvey@protonmail.com";
     github = "pkharvey";
diff --git a/maintainers/scripts/eval-release.nix b/maintainers/scripts/eval-release.nix
index bb9572cbc795..4f0ca2465025 100644
--- a/maintainers/scripts/eval-release.nix
+++ b/maintainers/scripts/eval-release.nix
@@ -17,6 +17,7 @@ let
         if (builtins.tryEval attrs.drvPath).success
         then { inherit (attrs) name drvPath; }
         else { failed = true; }
+      else if attrs == null then {}
       else { recurseForDerivations = true; } //
            mapAttrs (n: v: let path' = path ++ [n]; in trace path' (recurse path' v)) attrs
     else { };
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index bfc763e25467..4e4612ef922c 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-GTrcUy10bN9Xj2I7uuGyP82c6NVpnQbXTI85H231yyo=";
+    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/applications/audio/pianotrans/default.nix b/pkgs/applications/audio/pianotrans/default.nix
new file mode 100644
index 000000000000..89e0716a0adc
--- /dev/null
+++ b/pkgs/applications/audio/pianotrans/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchFromGitHub
+, python3
+, ffmpeg
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "pianotrans";
+  version = "1.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "azuwis";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-6Otup1Yat1dBZdSoR4lDfpytUQ2RbDXC6ieo835Nw+U=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    piano-transcription-inference
+    torch
+    tkinter
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  makeWrapperArgs = [
+    ''--prefix PATH : "${lib.makeBinPath [ ffmpeg ]}"''
+  ];
+
+  meta = with lib; {
+    description = "Simple GUI for ByteDance's Piano Transcription with Pedals";
+    homepage = "https://github.com/azuwis/pianotrans";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/applications/emulators/ppsspp/default.nix b/pkgs/applications/emulators/ppsspp/default.nix
index e730131ed6ff..a2664e12641d 100644
--- a/pkgs/applications/emulators/ppsspp/default.nix
+++ b/pkgs/applications/emulators/ppsspp/default.nix
@@ -115,10 +115,10 @@ stdenv.mkDerivation (self: {
       runHook postInstall
     '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.ppsspp.org/";
     description = "A HLE Playstation Portable emulator, written in C++ ("
-                  ++ (if enableQt then "Qt" else "SDL + headless") ++ ")";
+                  + (if enableQt then "Qt" else "SDL + headless") + ")";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 408838a0a284..fb3e149bc8e8 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "cotp";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-SbS+ch7/45kZb49jW2mnRWQruLrfrNfeZFqEPHQKGUg=";
+    hash = "sha256-DIb/lgJxwg+QuqzN/0YoUV1iZwRqh6PAN0KRK7TbWDs=";
   };
 
-  cargoHash = "sha256-2lIR3K4/hr4XSmNGFd/dhwoFOtEB9KSnUrZkcaCyc9k=";
+  cargoHash = "sha256-uvH4mdI8ya/MJJngXQ98oXjG7JjUdvPwIzvJrdwlOEE=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/misc/gImageReader/default.nix b/pkgs/applications/misc/gImageReader/default.nix
index f570a044309e..4e215f30fc31 100644
--- a/pkgs/applications/misc/gImageReader/default.nix
+++ b/pkgs/applications/misc/gImageReader/default.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gImageReader";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner= "manisandro";
     repo = "gImageReader";
     rev = "v${version}";
-    sha256 = "sha256-lJ4wPLxVN3NERnru8vLreiWMEUip6xeCXAfoT8DcfiQ=";
+    sha256 = "sha256-vW4FbviMHBiJ3rwJY/yS7JDOoCT72nGV6jEeo+k6ylU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
index fedf499d481e..41fe5cb96094 100644
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd-autopilot";
-  version = "0.4.10";
+  version = "0.4.11";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
     rev = "v${version}";
-    sha256 = "sha256-DUWJDWqB+jyp3/2/eFP1ss2grNtrvUuvGWK0FYTXObc=";
+    sha256 = "sha256-0y7WP6v1DrAyK9p9cVME9RpNH1ZY0NNMtjHhmPT68kQ=";
   };
 
-  vendorHash = "sha256-4ylOLnpvz/aQIoxVz2z69Rq/x2UG91yMmtSHyquvNq0=";
+  vendorHash = "sha256-KkklEcxk6pNbxSkomh3LqlK8jgpGC/pZMBkJgXMUi8E=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/cluster/kubeone/default.nix b/pkgs/applications/networking/cluster/kubeone/default.nix
index 96e0e4894ec6..3d569d4bdca8 100644
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    hash = "sha256-PdrU3kKuoT4MP5N2t4E1PIKZOMu8D0ZbUyMTIi/KZ7g=";
+    hash = "sha256-u0ievi2Zj5kerTQWhNPkT3HFdLYVwHOigkvWk6Zc3go=";
   };
 
   vendorHash = "sha256-Y4eivDchnN2rtQWjFY3cFiJXRfj48UfVUKM/OLuWXGA=";
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 7e268e27f1a0..88319182a648 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-INoJcb6XUMvT1E56hC3BGK3Ax+v4jSRpZV12zpjYfMA=";
+    sha256 = "sha256-zdOcQ/+WXS7pDfnvYdb/FDjMT3yJdwnS8DoH2MIDcDs=";
   };
 
   CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorSha256 = "sha256-kKIekANzLY2TYFyII1/BkKkqPYgmHB9xEfAVhJyI8FI=";
+  vendorHash = "sha256-kx94B1XIXWJOY9Y69lNb/sHWVjsuFuOXrdtJFJrUuAs=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix b/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
index 67edd3d1b274..8613a2585e2c 100644
--- a/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "briar-desktop";
-  version = "0.3.1-beta";
+  version = "0.4.0-beta";
 
   src = fetchurl {
-    url = "https://desktop.briarproject.org/jars/linux/0.3.1-beta/briar-desktop-linux-0.3.1-beta.jar";
-    sha256 = "841dc198101e6e8aa6b5ab6bd6b80e9c6b2593cb88bc3b2592f947baf963389d";
+    url = "https://desktop.briarproject.org/jars/linux/${version}/briar-desktop-linux-${version}.jar";
+    hash = "sha256-7zeIWsdPvROHGaf5igodlZss6Gow3kp6PX+QAzmxMnw=";
   };
 
   dontUnpack = true;
@@ -58,6 +58,6 @@ stdenv.mkDerivation rec {
     homepage = "https://code.briarproject.org/briar/briar-desktop";
     license = licenses.gpl3;
     maintainers = with maintainers; [ onny ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/rymdport/default.nix b/pkgs/applications/networking/rymdport/default.nix
index dfd9d50b1951..e2b6e86c6cbd 100644
--- a/pkgs/applications/networking/rymdport/default.nix
+++ b/pkgs/applications/networking/rymdport/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "rymdport";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "Jacalz";
     repo = "rymdport";
     rev = "v${version}";
-    hash = "sha256-IsUKZL1aOKH01yZ7e/ciAESQKdZSscH+ytI3wptChy0=";
+    hash = "sha256-8Iul8YSxrfP7uG/uSmV+Qro+B1r+mhkOxCICHf204Lg=";
   };
 
   vendorHash = "sha256-9Z++E4Lb1+VBvOx5GJ4yQuj7fpwUhlsMhavTifKxVw4=";
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 9210722c4e1d..1b4734027b7d 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -39,20 +39,15 @@ buildGoModule rec {
 
   buildInputs = lib.optional pamSupport pam;
 
-  preBuild =
-    let
-      tags = lib.optional pamSupport "pam"
-        ++ lib.optional sqliteSupport "sqlite sqlite_unlock_notify";
-      tagsString = lib.concatStringsSep " " tags;
-    in
-    ''
-      export buildFlagsArray=(
-        -tags="${tagsString}"
-        -ldflags='-X "main.Version=${version}" -X "main.Tags=${tagsString}"'
-      )
-    '';
+  tags = lib.optional pamSupport "pam"
+    ++ lib.optionals sqliteSupport [ "sqlite" "sqlite_unlock_notify" ];
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${version}"
+    "-X 'main.Tags=${lib.concatStringsSep " " tags}'"
+  ];
 
   outputs = [ "out" "data" ];
 
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index a36dc3bc2503..06eb8d78f06e 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "15.7.5",
-  "repo_hash": "sha256-zo1b82y114NpX43rJAWQmUhORM1kQxyiSnonqPUQJmY=",
-  "yarn_hash": "086v3lr4hnz8z8pla1d3mi2smldidmx2z2cmffn830ianpqkk83l",
+  "version": "15.8.1",
+  "repo_hash": "sha256-AdgebB7IY18u/J1F67oNnwVYmmeYJPNCI/yll2eZEiQ=",
+  "yarn_hash": "1famdjvsbhvnkg5sp2vnc3jzaixww41833pb0427s3qpig0fc7az",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.7.5-ee",
+  "rev": "v15.8.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.7.5",
-    "GITLAB_PAGES_VERSION": "15.7.5",
-    "GITLAB_SHELL_VERSION": "14.14.0",
-    "GITLAB_WORKHORSE_VERSION": "15.7.5"
+    "GITALY_SERVER_VERSION": "15.8.1",
+    "GITLAB_PAGES_VERSION": "15.8.1",
+    "GITLAB_SHELL_VERSION": "14.15.0",
+    "GITLAB_WORKHORSE_VERSION": "15.8.1"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index da95241d34c4..2b90a2e0cdaf 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -80,7 +80,7 @@ GEM
       reverse_markdown (~> 1.0)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    loofah (2.19.0)
+    loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -90,7 +90,7 @@ GEM
     minitest (5.16.3)
     msgpack (1.3.3)
     multipart-post (2.1.1)
-    nokogiri (1.13.8)
+    nokogiri (1.13.10)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.20.0)
@@ -112,15 +112,15 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (4.0.7)
-    racc (1.6.0)
+    racc (1.6.1)
     rack (2.2.4)
     rack-test (2.0.2)
       rack (>= 1.3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
+    rails-html-sanitizer (1.4.4)
+      loofah (~> 2.19, >= 2.19.1)
     rainbow (3.0.0)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 9f217aa65f34..28452edbfe46 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "15.7.5";
+  version = "15.8.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -22,10 +22,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-FT77MUcErc/16tChwyNczCLtADTOEzKKTsTlhLI6aV8=";
+      sha256 = "sha256-TolduUm8OhpubHXMCyy0vQhj65lauh5eST5UDvdWNVE=";
     };
 
-    vendorSha256 = "sha256-UEEM0mv7d0gmDcsSKbeh4JcTnX4f5oogZnhRpqaNxwY=";
+    vendorSha256 = "sha256-8P5X/bqeI1hY45IGsvEWOg3GuetEQF/XtZzUMdX22pA=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 
diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index f7471a12b008..f3a4a082f205 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -317,10 +317,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fpyk1965py77al7iadkn5dibwgvybknkr7r8bii2dj73wvr29rh";
+      sha256 = "08qhzck271anrx9y6qa6mh8hwwdzsgwld8q0000rcd7yvvpnjr3c";
       type = "gem";
     };
-    version = "2.19.0";
+    version = "2.19.1";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -385,10 +385,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7axlq2y6gzmixzzzhw3fn6nhrhg469jj8gfr7gs8igiclpkhkr";
+      sha256 = "0n79k78c5vdcyl0m3y3l5x9kxl6xf5lgriwi2vd665qmdkr01vnk";
       type = "gem";
     };
-    version = "1.13.8";
+    version = "1.13.10";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -494,10 +494,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
+      sha256 = "0p685i23lr8pl7l09g9l2mcj615fr7g33w3mkcr472lcg34nq8n8";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.1";
   };
   rack = {
     groups = ["default"];
@@ -537,10 +537,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mj0b7ay10a2fgwj70kjw7mlyrp7a5la8lx8zmwhy40bkansdfrf";
+      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.4";
   };
   rainbow = {
     source = {
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 74fd1ab320e0..25e2a0642423 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.14.0";
+  version = "14.15.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-zXRLaEy2Q+mm1GLjLB1AxRtBxXAoLw6PA1YOJfvVhoc=";
+    sha256 = "sha256-GDhYBL5LT3r6UIjDDY3LV5VgcBch190hYLPb6uMWETs=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-mhmM33cXJbqVJ1jY82Mi/nWzz7HXdxxSsFNQknFkwpQ=";
+  vendorSha256 = "sha256-2DpQNJw67ipIW3ctHDJthuDrKNZCYvjXGlDxzBEMGWs=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index b164076c28b6..7a808ee2ff64 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.7.5";
+  version = "15.8.1";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-TrLc5L4kLAdu1CEM3ezw6hhF6Icy3rXkFyUaVTUQ6X4=";
+  vendorSha256 = "sha256-0FWR6cIV/0R2OrOAKhvuVnIY3Hkw4CIjyBUeF/paumw=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 417dc56637da..96517b56ff91 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -5,7 +5,7 @@ source 'https://rubygems.org'
 if ENV['BUNDLER_CHECKSUM_VERIFICATION_OPT_IN'] # this verification is still experimental
   $LOAD_PATH.unshift(File.expand_path("vendor/gems/bundler-checksum/lib", __dir__))
   require 'bundler-checksum'
-  Bundler::Checksum.patch!
+  BundlerChecksum.patch!
 end
 
 gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false
@@ -37,7 +37,7 @@ gem 'view_component', '~> 2.74.1'
 gem 'default_value_for', '~> 3.4.0'
 
 # Supported DBs
-gem 'pg', '~> 1.4.3'
+gem 'pg', '~> 1.4.5'
 
 gem 'rugged', '~> 1.2'
 gem 'grape-path-helpers', '~> 1.7.1'
@@ -84,7 +84,7 @@ gem 'gssapi', group: :kerberos
 gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos
 
 # Spam and anti-bot protection
-gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
+gem 'recaptcha', '~> 5.12', require: 'recaptcha/rails'
 gem 'akismet', '~> 3.0'
 gem 'invisible_captcha', '~> 2.0.0'
 
@@ -113,7 +113,7 @@ gem 'gpgme', '~> 2.0.22'
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
 gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.16.3'
+gem 'net-ldap', '~> 0.17.1'
 
 # API
 gem 'grape', '~> 1.5.2'
@@ -200,7 +200,7 @@ gem 'diffy', '~> 3.4'
 gem 'diff_match_patch', '~> 0.1.0'
 
 # Application server
-gem 'rack', '~> 2.2.4'
+gem 'rack', '~> 2.2.6', '>= 2.2.6.2'
 # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
 
@@ -304,7 +304,7 @@ gem 'fast_blank'
 gem 'gitlab-chronic', '~> 0.10.5'
 gem 'gitlab_chronic_duration', '~> 0.10.6.2'
 
-gem 'rack-proxy', '~> 0.7.4'
+gem 'rack-proxy', '~> 0.7.6'
 
 gem 'sassc-rails', '~> 2.1.0'
 gem 'autoprefixer-rails', '10.2.5.1'
@@ -358,12 +358,12 @@ gem 'prometheus-client-mmap', '~> 0.17', require: 'prometheus/client'
 gem 'warning', '~> 1.3.0'
 
 group :development do
-  gem 'lefthook', '~> 1.2.6', require: false
+  gem 'lefthook', '~> 1.2.7', require: false
   gem 'rubocop'
   gem 'solargraph', '~> 0.47.2', require: false
 
   gem 'letter_opener_web', '~> 2.0.0'
-  gem 'lookbook', '~> 1.2', '>= 1.2.1'
+  gem 'lookbook', '~> 1.4', '>= 1.4.5'
 
   # Better errors handler
   gem 'better_errors', '~> 2.9.1'
@@ -395,7 +395,7 @@ group :development, :test do
   gem 'spring', '~> 4.1.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
 
-  gem 'gitlab-styles', '~> 9.1.0', require: false
+  gem 'gitlab-styles', '~> 9.2.0', require: false
 
   gem 'haml_lint', '~> 0.40.0', require: false
   gem 'bundler-audit', '~> 0.7.0.1', require: false
@@ -538,7 +538,7 @@ gem 'mail-smtp_pool', '~> 0.1.0', path: 'vendor/gems/mail-smtp_pool', require: f
 gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer'
 
 # File encryption
-gem 'lockbox', '~> 0.6.2'
+gem 'lockbox', '~> 1.1.1'
 
 # Email validation
 gem 'valid_email', '~> 0.1'
@@ -574,6 +574,7 @@ gem 'arr-pm', '~> 0.0.12'
 
 # Apple plist parsing
 gem 'CFPropertyList'
+gem 'app_store_connect'
 
 # For phone verification
 gem 'telesignenterprise', '~> 2.2'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 087d4d8aeec0..ea1771e5af3b 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -172,6 +172,9 @@ GEM
     apollo_upload_server (2.1.0)
       actionpack (>= 4.2)
       graphql (>= 1.8)
+    app_store_connect (0.29.0)
+      activesupport (>= 6.0.0)
+      jwt (>= 1.4, <= 2.5.0)
     arr-pm (0.0.12)
     asana (0.10.13)
       faraday (~> 1.0)
@@ -598,7 +601,7 @@ GEM
     gitlab-sidekiq-fetcher (0.9.0)
       json (>= 2.5)
       sidekiq (~> 6.1)
-    gitlab-styles (9.1.0)
+    gitlab-styles (9.2.0)
       rubocop (~> 1.38.0)
       rubocop-gitlab-security (~> 0.1.1)
       rubocop-graphql (~> 0.14)
@@ -832,7 +835,7 @@ GEM
       kramdown (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.2.6)
+    lefthook (1.2.7)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -861,7 +864,7 @@ GEM
       ffi-compiler (~> 1.0)
       rake (~> 13.0)
     locale (2.1.3)
-    lockbox (0.6.2)
+    lockbox (1.1.1)
     lograge (0.11.2)
       actionpack (>= 4)
       activesupport (>= 4)
@@ -870,7 +873,7 @@ GEM
     loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    lookbook (1.2.1)
+    lookbook (1.4.5)
       actioncable
       activemodel
       css_parser
@@ -930,7 +933,7 @@ GEM
     nenv (0.3.0)
     net-http-persistent (4.0.1)
       connection_pool (~> 2.2)
-    net-ldap (0.16.3)
+    net-ldap (0.17.1)
     net-ntp (2.1.3)
     net-scp (3.0.0)
       net-ssh (>= 2.6.5, < 7.0.0)
@@ -1068,7 +1071,7 @@ GEM
       tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
-    pg (1.4.3)
+    pg (1.4.5)
     pg_query (2.2.0)
       google-protobuf (>= 3.19.2)
     plist (3.6.0)
@@ -1108,7 +1111,7 @@ GEM
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.6.1)
-    rack (2.2.4)
+    rack (2.2.6.2)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.6.1)
@@ -1123,7 +1126,7 @@ GEM
       rack (>= 2.1.0)
     rack-protection (2.2.2)
       rack
-    rack-proxy (0.7.4)
+    rack-proxy (0.7.6)
       rack
     rack-test (2.0.2)
       rack (>= 1.3)
@@ -1150,8 +1153,8 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
+    rails-html-sanitizer (1.4.4)
+      loofah (~> 2.19, >= 2.19.1)
     rails-i18n (7.0.3)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
@@ -1174,7 +1177,7 @@ GEM
     rchardet (1.8.0)
     rdoc (6.3.2)
     re2 (1.6.0)
-    recaptcha (4.13.1)
+    recaptcha (5.12.3)
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.5.1)
@@ -1274,14 +1277,14 @@ GEM
       rubocop (>= 0.51)
     rubocop-graphql (0.18.0)
       rubocop (>= 0.87, < 2)
-    rubocop-performance (1.15.0)
+    rubocop-performance (1.15.1)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.17.2)
+    rubocop-rails (2.17.3)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
-    rubocop-rspec (2.15.0)
+    rubocop-rspec (2.16.0)
       rubocop (~> 1.33)
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
@@ -1581,6 +1584,7 @@ DEPENDENCIES
   addressable (~> 2.8)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.1.0)
+  app_store_connect
   arr-pm (~> 0.0.12)
   asana (~> 0.10.13)
   asciidoctor (~> 2.0.17)
@@ -1672,7 +1676,7 @@ DEPENDENCIES
   gitlab-net-dns (~> 0.9.1)
   gitlab-omniauth-openid-connect (~> 0.10.0)
   gitlab-sidekiq-fetcher (= 0.9.0)
-  gitlab-styles (~> 9.1.0)
+  gitlab-styles (~> 9.2.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.2.0)
   gon (~> 6.4.0)
@@ -1716,15 +1720,15 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.9.3)!
-  lefthook (~> 1.2.6)
+  lefthook (~> 1.2.7)
   letter_opener_web (~> 2.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.15)
   listen (~> 3.7)
-  lockbox (~> 0.6.2)
+  lockbox (~> 1.1.1)
   lograge (~> 0.5)
   loofah (~> 2.19.1)
-  lookbook (~> 1.2, >= 1.2.1)
+  lookbook (~> 1.4, >= 1.4.5)
   lru_redux
   mail (= 2.7.1)
   mail-smtp_pool (~> 0.1.0)!
@@ -1734,7 +1738,7 @@ DEPENDENCIES
   mini_magick (~> 4.10.1)
   minitest (~> 5.11.0)
   multi_json (~> 1.14.1)
-  net-ldap (~> 0.16.3)
+  net-ldap (~> 0.17.1)
   net-ntp
   nokogiri (~> 1.13.10)
   oauth2 (~> 2.0)
@@ -1767,7 +1771,7 @@ DEPENDENCIES
   parallel (~> 1.19)
   parslet (~> 1.8)
   peek (~> 1.1)
-  pg (~> 1.4.3)
+  pg (~> 1.4.5)
   pg_query (~> 2.2)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
@@ -1777,11 +1781,11 @@ DEPENDENCIES
   pry-shell (~> 0.5.1)
   puma (~> 5.6.5)
   puma_worker_killer (~> 0.3.1)
-  rack (~> 2.2.4)
+  rack (~> 2.2.6, >= 2.2.6.2)
   rack-attack (~> 6.6.1)
   rack-cors (~> 1.1.1)
   rack-oauth2 (~> 1.21.3)
-  rack-proxy (~> 0.7.4)
+  rack-proxy (~> 0.7.6)
   rack-timeout (~> 0.6.3)
   rails (~> 6.1.6.1)
   rails-controller-testing
@@ -1790,7 +1794,7 @@ DEPENDENCIES
   rbtrace (~> 0.4)
   rdoc (~> 6.3.2)
   re2 (~> 1.6.0)
-  recaptcha (~> 4.11)
+  recaptcha (~> 5.12)
   redis (~> 4.8.0)
   redis-actionpack (~> 5.3.0)
   redis-namespace (~> 1.9.0)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 968d07704fcb..269318a0961d 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -206,6 +206,17 @@ src:
     };
     version = "2.1.0";
   };
+  app_store_connect = {
+    dependencies = ["activesupport" "jwt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03s3x8b6ifjrqk9ian59i9yyxxl65ykvbb4r424j2hjsh8iskmq1";
+      type = "gem";
+    };
+    version = "0.29.0";
+  };
   arr-pm = {
     groups = ["default"];
     platforms = [];
@@ -2177,10 +2188,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ch27hxbby16jxvxg1jq3sqdbd3gg7ss4ymxn3yhsjy7gyglxza6";
+      sha256 = "196fhlbhhanpbn5iriccp7m04xgkq7swyk07im50q7z05pxyf1ki";
       type = "gem";
     };
-    version = "9.1.0";
+    version = "9.2.0";
   };
   gitlab_chronic_duration = {
     dependencies = ["numerizer"];
@@ -3098,10 +3109,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qyylcc57pcf8mwm9dvlzkfjxcpbypnp4q21ni05s7wxalxb12ld";
+      sha256 = "18vcakjkb5fhavq9s6j7zwjc14c652361qws5g1slqb300anfww2";
       type = "gem";
     };
-    version = "1.2.6";
+    version = "1.2.7";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3194,10 +3205,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g6w327y8d7dr0d7zw6p7hmlwh0hcvb7pkc7xxyf5mn3fmw6fdh1";
+      sha256 = "1h1a3h3rfv3094pn5zn7d3c066dmhx9i380mhqa1qyagqla6pw8a";
       type = "gem";
     };
-    version = "0.6.2";
+    version = "1.1.1";
   };
   lograge = {
     dependencies = ["actionpack" "activesupport" "railties" "request_store"];
@@ -3227,10 +3238,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mv5q4gpgzklwrgp7s7mhi0gb7x739qhyrni2n96i2vr4nv48a3l";
+      sha256 = "1nww5h9frmbjfpfy2nb296vn78xnq1qg0lq3lsn52ky8s8rb65dw";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.4.5";
   };
   lru_redux = {
     groups = ["default"];
@@ -3581,10 +3592,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13lh6qizxi8fza8py73b2dvjp9p010dvbaq7diagir9nh8plsinv";
+      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
       type = "gem";
     };
-    version = "0.16.3";
+    version = "0.17.1";
   };
   net-ntp = {
     groups = ["default"];
@@ -4153,10 +4164,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ypj64nhq3grs9zh40vmyfyhmxlhljjsbg5q0jxhlxg5v76ij0mb";
+      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.5";
   };
   pg_query = {
     dependencies = ["google-protobuf"];
@@ -4358,10 +4369,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0axc6w0rs4yj0pksfll1hjgw1k6a5q0xi2lckh91knfb72v348pa";
+      sha256 = "0qvp6h2abmlsl4sqjsvac03cr2mxq6143gbx4kq52rpazp021qsb";
       type = "gem";
     };
-    version = "2.2.4";
+    version = "2.2.6.2";
   };
   rack-accept = {
     dependencies = ["rack"];
@@ -4424,10 +4435,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m6j2xk3s3ps3r9vqgwq3flyij9jgkyzanmgiifid8yqhcskgfx8";
+      sha256 = "1a62439xwn5v6hsl9s11hdk4wj58czhcbg7lminv23mnkc0ca147";
       type = "gem";
     };
-    version = "0.7.4";
+    version = "0.7.6";
   };
   rack-test = {
     dependencies = ["rack"];
@@ -4489,10 +4500,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mj0b7ay10a2fgwj70kjw7mlyrp7a5la8lx8zmwhy40bkansdfrf";
+      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.4";
   };
   rails-i18n = {
     dependencies = ["i18n" "railties"];
@@ -4614,10 +4625,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "121pkq8kwqjh4l751xzx15bjp5vmf5pirfmpb11h71zsiavjqv6w";
+      sha256 = "1vmpppgdy64qa16bvkss0xyzmyyzxv5hwzvc1i6saw4yvm58kl9p";
       type = "gem";
     };
-    version = "4.13.1";
+    version = "5.12.3";
   };
   recursive-open-struct = {
     groups = ["default"];
@@ -5020,10 +5031,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h06a2asg8pjq7l0k885126n60y54rgw0qr957qarpv7qligzn4c";
+      sha256 = "00ld0hfm2x5hzms9xhkyjfxs8afsmlg1kf0mklk68cq4wwwihkwd";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.15.1";
   };
   rubocop-rails = {
     dependencies = ["activesupport" "rack" "rubocop"];
@@ -5031,10 +5042,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "052viwgi7dbbnq0pxihz1k72dwhph8gw4v2zzw057w42l39hhh6i";
+      sha256 = "1bv51vwcg5m4v35n7653xclw9vv3ifvgbhvc2l79wz2p76ipm1bx";
       type = "gem";
     };
-    version = "2.17.2";
+    version = "2.17.3";
   };
   rubocop-rspec = {
     dependencies = ["rubocop"];
@@ -5042,10 +5053,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pj53m5zcrgyhb2zsjxqsav9sm9s8jh0mgk8c1qckaxy3dkwfxm4";
+      sha256 = "1rpcww107xq6aj5wkypzjj346jaxhqal33wmhlwb9gc2h425yg5k";
       type = "gem";
     };
-    version = "2.15.0";
+    version = "2.16.0";
   };
   ruby-fogbugz = {
     dependencies = ["crack" "multipart-post"];
diff --git a/pkgs/applications/version-management/got/default.nix b/pkgs/applications/version-management/got/default.nix
index 7db96739b2b5..e601b1165f5d 100644
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "got";
-  version = "0.82";
+  version = "0.83";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "sha256-Lb0WZ4gTuG/GBAnEh9ff/K0ciwjDX3cmEhItMyJ/lmI=";
+    sha256 = "sha256-kNhU6OR9IUNPL72D90nhq2X5vmVW7YUmpnq/EOUvG/8=";
   };
 
   nativeBuildInputs = [ pkg-config bison ];
diff --git a/pkgs/applications/version-management/sublime-merge/default.nix b/pkgs/applications/version-management/sublime-merge/default.nix
index ceee5d6b4886..62122bc35b15 100644
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@@ -9,8 +9,8 @@ in {
   } {};
 
   sublime-merge-dev = common {
-    buildVersion = "2081";
-    x64sha256 = "QzJP25KxczmrR5PZ9ujRSM3V+TrKqiH82plo1bTv48s=";
+    buildVersion = "2082";
+    x64sha256 = "Gl1BrLTSDLRTgrYQW/99o0XRjSIxvnNYRIViZEidcsM=";
     dev = true;
   } {};
 }
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 60d05f6f2309..b37937e7461c 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.7.2";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SNNy/oI3ZcMeRLEMS2nSCS/rRaen5WsDfhdlHQCdtP4=";
+    hash = "sha256-8R9cja8Blk+7Sp25bJ9t9e0TvazD41livK+KKAwRpLg=";
     fetchSubmodules = true;
   };
 
@@ -74,9 +74,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
+    homepage = "https://github.com/containers/crun";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    inherit (src.meta) homepage;
     maintainers = with maintainers; [ ] ++ teams.podman.members;
   };
 }
diff --git a/pkgs/data/fonts/roboto-serif/default.nix b/pkgs/data/fonts/roboto-serif/default.nix
new file mode 100644
index 000000000000..d6cc1019ccd4
--- /dev/null
+++ b/pkgs/data/fonts/roboto-serif/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "roboto-serif";
+  version = "1.007";
+
+  src = fetchurl {
+    url = "https://github.com/googlefonts/roboto-serif/releases/download/v${version}/RobotoSerifFonts-v${version}.zip";
+    hash = "sha256-A14GztkTvaLBvcm1i3A0Vi9vaz77nFYYoSNggqbffFo=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    unzip
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 variable/*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The Roboto family of fonts";
+    longDescription = ''
+      Google’s signature family of fonts, the default font on Android and
+      Chrome OS, and the recommended font for Google’s visual language,
+      Material Design.
+    '';
+    homepage = "https://github.com/googlefonts/roboto-serif";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index ef69669ece5b..f966f22b8285 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.01.25";
+  version = "23.01.29";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bejoClo31C2gO7Ni1cIxaumwDrhumRZgAPpxS1Jt/Fw=";
+    sha256 = "sha256-VmVzU8ACBE4Rx0uVScdQVbygDLE9MmD7ssD1j4ri74g=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
new file mode 100644
index 000000000000..657b69e6d95a
--- /dev/null
+++ b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, dde-qt-dbus-factory
+, cmake
+, qtbase
+, qttools
+, qtx11extras
+, pkg-config
+, wrapQtAppsHook
+, at-spi2-core
+, libsecret
+, chrpath
+, lxqt
+, gtest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-terminal";
+  version = "5.4.34";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-CpI7dyQwrYOYzqVZ6aa+/OAUC3xRyY4ZwzH1mqURTfY=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "chore: use GNUInstallDirs in CmakeLists";
+      url = "https://github.com/linuxdeepin/deepin-terminal/commit/b18a2ca8411f09f5573aa2a8403a484b693ec975.patch";
+      sha256 = "sha256-Qy8Jg+7BfZr8tQEsCAzhMEwf6rU96gkgup5f9bMMELY=";
+    })
+  ];
+
+  cmakeFlags = [ "-DVERSION=${version}" ];
+
+  nativeBuildInputs = [
+    cmake
+    qttools
+    pkg-config
+    wrapQtAppsHook
+    lxqt.lxqt-build-tools
+  ];
+
+  buildInputs = [
+    dtkwidget
+    qt5platform-plugins
+    dde-qt-dbus-factory
+    qtx11extras
+    at-spi2-core
+    libsecret
+    chrpath
+    gtest
+  ];
+
+  strictDeps = true;
+
+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
+  meta = with lib; {
+    description = "Terminal emulator with workspace, multiple windows, remote management, quake mode and other features";
+    homepage = "https://github.com/linuxdeepin/deepin-terminal";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 436f06ae5ae0..69f6afff8ee0 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -22,6 +22,7 @@ let
 
     #### Dtk Application
     deepin-calculator = callPackage ./apps/deepin-calculator { };
+    deepin-terminal = callPackage ./apps/deepin-terminal { };
 
     #### ARTWORK
     dde-account-faces = callPackage ./artwork/dde-account-faces { };
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index c9e9b00f60ed..25e59148440a 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -119,7 +119,7 @@ let
       #  or ${with_sysroot}${native_system_header_dir}
       # While native build (build == host == target) uses passed headers
       # path as is:
-      #    ${native_system_header_dir}
+      #    ${with_build_sysroot}${native_system_header_dir}
       #
       # Nixpkgs uses flat directory structure for both native and cross
       # cases. As a result libc headers don't get found for cross case
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index 5f38c4bbae24..b574f4c9fb20 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -6,6 +6,7 @@
   repo = "Coq-Equations";
   inherit version;
   defaultVersion = lib.switch coq.coq-version [
+    { case = "8.17"; out = "1.3+8.17"; }
     { case = "8.16"; out = "1.3+8.16"; }
     { case = "8.15"; out = "1.3+8.15"; }
     { case = "8.14"; out = "1.3+8.14"; }
@@ -54,6 +55,8 @@
     release."1.3+8.15".sha256         = "1vfcfpsp9zyj0sw0cwibk76nj6n0r6gwh8m1aa3lbvc0b1kbm32k";
     release."1.3+8.16".rev            = "v1.3-8.16";
     release."1.3+8.16".sha256         = "sha256-zyMGeRObtSGWh7n3WCqesBZL5EgLvKwmnTy09rYpxyE=";
+    release."1.3+8.17".rev            = "v1.3-8.17";
+    release."1.3+8.17".sha256         = "sha256-yNotSIxFkhTg3reZIchGQ7cV9WmTJ7p7hPfKGBiByDw=";
 
   mlPlugin = true;
 
diff --git a/pkgs/development/interpreters/erlang/R25.nix b/pkgs/development/interpreters/erlang/R25.nix
index d6dc77c3da69..b2ad0846cd68 100644
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.2.1";
-  sha256 = "xJ3fadveOFZ0TeHhjl3VnAtWyFTOVUIoFubXofvrsT0=";
+  version = "25.2.2";
+  sha256 = "HfEh2IhifFe/gQ4sK99uBnmUGvNCeJ2mlTQf7IzenEs=";
 }
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index b6bb4c16634f..5666b078b4c3 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-t/ObsvUSNGFvHkVH2nl8vLFI+5GUQx6niCgeH4ykk/0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-797I3FBBfnAgNfOdMajm3WNkMo3MUXb1347LBggXrLk=";
   };
 
-  cargoSha256 = "sha256-75/0D0lrV50wH51Ll7M1Lvqj2kRSaJXiQWElxCaF9mE=";
+  cargoHash = "sha256-zUTwhfRLKUixgj3JXiz2QOuwbFhfget+GcFSRL1QJ3w=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/development/libraries/libfabric/default.nix b/pkgs/development/libraries/libfabric/default.nix
index 35ad72f8c7e9..baa33a51eef9 100644
--- a/pkgs/development/libraries/libfabric/default.nix
+++ b/pkgs/development/libraries/libfabric/default.nix
@@ -1,18 +1,9 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, autoreconfHook
-, enablePsm2 ? (stdenv.isx86_64 && stdenv.isLinux)
-, libpsm2
-, enableOpx ? (stdenv.isx86_64 && stdenv.isLinux)
-, libuuid
-, numactl
-}:
+{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, libpsm2
+, enablePsm2 ? (stdenv.isx86_64 && stdenv.isLinux) }:
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.17.0";
+  version = "1.15.1";
 
   enableParallelBuilding = true;
 
@@ -20,17 +11,14 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tXfAn8hkasA2UuA4/8dOE3EcORyJo/A33TtSNdzDXD8=";
+    sha256 = "sha256-uL3L9k9yqdZXQmR1zi8OEIGLAZ8cf7EBnlDhetaMA08=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
 
-  buildInputs = lib.optionals enableOpx [ libuuid numactl ] ++ lib.optional enablePsm2 [ libpsm2 ];
+  buildInputs = lib.optional enablePsm2 libpsm2;
 
-  configureFlags = [
-    (if enablePsm2 then "--enable-psm2=${libpsm2}" else "--disable-psm2")
-    (if enableOpx then "--enable-opx" else "--disable-opx")
-  ];
+  configureFlags = [ (if enablePsm2 then "--enable-psm2=${libpsm2}" else "--disable-psm2") ];
 
   meta = with lib; {
     homepage = "https://ofiwg.github.io/libfabric/";
diff --git a/pkgs/development/libraries/live555/default.nix b/pkgs/development/libraries/live555/default.nix
index 7ceb70bb8bcd..1e6311692a05 100644
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "live555";
-  version = "2022.12.01";
+  version = "2023.01.19";
 
   src = fetchurl {
     urls = [
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       "https://download.videolan.org/contrib/live555/live.${version}.tar.gz"
       "mirror://sourceforge/slackbuildsdirectlinks/live.${version}.tar.gz"
     ];
-    sha256 = "sha256-BXwdPcJMJrM+FMTcNZKIWt8iBAOh4SVeihAeIzxpwQg=";
+    sha256 = "sha256-p8ZJE/f3AHxf3CnqgR48p4HyYicbPkKv3UvBBB2G+pk=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin darwin.cctools;
diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
index 4cf69bb795b1..df42dea81a5c 100644
--- a/pkgs/development/libraries/pinocchio/default.nix
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pinocchio";
-  version = "2.6.14";
+  version = "2.6.15";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-3dPGeWnIVIErLnd+mxwudTj4qHyN2k7H94EsHYmKV1I=";
+    hash = "sha256-bnm5nbb0mKw76k2J2Qi04n7bmfzadtqV/AmnWSzbb+0=";
   };
 
   # error: use of undeclared identifier '__sincos'
diff --git a/pkgs/development/ocaml-modules/ocaml-r/default.nix b/pkgs/development/ocaml-modules/ocaml-r/default.nix
index fd628e7651c7..8de5abf7e481 100644
--- a/pkgs/development/ocaml-modules/ocaml-r/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-r/default.nix
@@ -1,44 +1,37 @@
-{ lib, fetchFromGitHub, buildDunePackage, pkg-config, dune-configurator, stdio, R
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, pkg-config, dune-configurator, stdio, R
 , alcotest
 }:
 
 buildDunePackage rec {
   pname = "ocaml-r";
-  version = "0.4.0";
+  version = "0.6.0";
 
-  useDune2 = true;
+  duneVersion = "3";
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "pveber";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10is2s148kfh3g0pwniyzp5mh48k57ldvn8gm86469zvgxyij1ri";
+    sha256 = "sha256-jPyVMxjeh9+xu0dD1gelAxcOhxouKczyvzVoKZ5oSrs=";
   };
 
-  # Without the following patch, stub generation fails with:
-  # > Fatal error: exception (Failure "not supported: osVersion")
-  preConfigure = ''
-    substituteInPlace stubgen/stubgen.ml --replace  \
-    'failwithf "not supported: %s" name ()' \
-    'sprintf "(* not supported: %s *)" name'
-    substituteInPlace lib/config/discover.ml --replace \
-    ' libRmath"' '"'
-  '';
-
-  # This currently fails with dune
-  strictDeps = false;
+  # Finds R and Rmathlib separatley
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pveber/ocaml-r/commit/aa96dc5.patch";
+      sha256 = "sha256-xW33W2ciesyUkDKEH08yfOXv0wP0V6X80or2/n2Nrb4=";
+    })
+  ];
 
   nativeBuildInputs = [ pkg-config R ];
   buildInputs = [ dune-configurator stdio R ];
 
   doCheck = true;
-  nativeCheckInputs = [ alcotest ];
+  checkInputs = [ alcotest ];
 
   meta = {
-    # This has been broken by the update to R 4.2.0 (#171597)
-    broken = true;
     description = "OCaml bindings for the R interpreter";
     inherit (src.meta) homepage;
     license = lib.licenses.gpl3;
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index d5ec32348e75..2e878b014cc2 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-t4t9TATmskvi/Qr9Eje7l+tRiKa+NiwI+KVYqEiSNgo=";
+    hash = "sha256-PEX2SanglMqjtJHuH+gA5dnikh7qqLFiXbmrcIzs1+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/airtouch4pyapi/default.nix b/pkgs/development/python-modules/airtouch4pyapi/default.nix
index 1c567181f9b4..de19c5965364 100644
--- a/pkgs/development/python-modules/airtouch4pyapi/default.nix
+++ b/pkgs/development/python-modules/airtouch4pyapi/default.nix
@@ -1,14 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , numpy
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "airtouch4pyapi";
-  version = "1.0.5";
+  version = "1.0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,19 +15,10 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "LonePurpleWolf";
     repo = pname;
-    # https://github.com/LonePurpleWolf/airtouch4pyapi/issues/5
-    rev = "34783888846783c058fe79cec16feda45504f701";
-    sha256 = "17c7fm72p085pg9msvsfdggbskvm12a6jlb5bw1cndrqsqcrxywx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RiRwebumidn0nijL/e9J74ZYx0DASi1up5BTNxYoGEA=";
   };
 
-  patches = [
-    # https://github.com/LonePurpleWolf/airtouch4pyapi/pull/10
-    (fetchpatch {
-      url = "https://github.com/LonePurpleWolf/airtouch4pyapi/commit/5b5d91fad63495c83422e7a850897946ac95b25d.patch";
-      hash = "sha256-tVlCLXuOJSqjbs0jj0iHCIXWZE8wmMV3ChzmE6uq3SM=";
-    })
-  ];
-
   propagatedBuildInputs = [
     numpy
   ];
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 0cb078f0f7ec..3e7aae7f3daa 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -47,6 +47,11 @@ buildPythonPackage rec {
       url = "https://github.com/amaranth-lang/amaranth/pull/722/commits/e5a56b07c568e5f4cc2603eefebd14c5cc4e13d8.patch";
       hash = "sha256-C8FyMSKHA7XsEMpO9eYNZx/X5rGaK7p3eXP+jSb6wVg=";
     })
+    (fetchpatch {
+      name = "add-python-3.11-support.patch";
+      url = "https://github.com/amaranth-lang/amaranth/commit/851546bf2d16db62663d7002bece51f07078d0a5.patch";
+      hash = "sha256-eetlFCLqmpCfTKViD16OScJbkql1yhdi5uJGnfnpcCE=";
+    })
   ];
 
   SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}";
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index c8b80357ca77..4abcad0e7c9b 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zJ3dURT2T44Nl0KPSw8bTeJO33siBLAOu/lXGaQeEdQ=";
+    hash = "sha256-KVIrhzd3EoDIVImshfjZrBAiNkCtlFAd6Ox9ATsvPTY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index 4347fd925dc1..894a30c7c606 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.6.1";
+  version = "0.6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "Apycula";
-    hash = "sha256-/XQ/Q4/LzCBDaTindbBENOh5OSIH2JPLyiYFWT9DcP4=";
+    hash = "sha256-WnxH/AKi7j2u1SWVtyggUD09OqXfOST1Ayr9DrbYMcQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index b2824ed9ae7e..22a460cc2741 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/GGchV+B/1gleZM0mW8vVk/9Uwf1zYH0B7HwziAla6w=";
+    hash = "sha256-anZsvDIH1AWaFUG5UTuyQiOKeoUB/+MSbu5pjPZJxag=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index a7b7564fd65b..a8811d7f37ac 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vfyrYcwQopwSxGAA+8JFCkog0Po/s9HkGI3PJzSALSI=";
+    hash = "sha256-gF8T1ZTvTjyt+kEOxI3ryDJOZv4go54VTxSGEdUyGt4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 0464777b5168..e1f022c1a463 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.35";
+  version = "9.2.36";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0qDSxB77kKwYCLPWt/Wb//LLTJC8WJIv0Cw+HwE21sQ=";
+    hash = "sha256-XqoBFV87m/uz0proGDtbaewsoY8vsA6ToGwdv7xvO9Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 48ad8d9ea87c..91c83942be8c 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.5";
+  version = "4.1.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/1br1+rQ/V2+Bv4VewAkp6rqLgWTuzeF+1lM+U2tWO8=";
+    hash = "sha256-vOsP4aOGeBrweIyuQQhiJ1bNBed3VEje7ASnHd+HaF0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/eigenpy/default.nix b/pkgs/development/python-modules/eigenpy/default.nix
index 4f070068a12d..66e6441c588d 100644
--- a/pkgs/development/python-modules/eigenpy/default.nix
+++ b/pkgs/development/python-modules/eigenpy/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenpy";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-gYGJutTnvq5ERv6tDff6b+t7Kitnx9QAD/6hauHxOt4=";
+    hash = "sha256-R+j68l2N+Qb2uqdl+Ng6nwj8O3YhqXgnYZBIzZ06aRA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 9826ae25170f..c4070226eee6 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.7.0";
+  version = "1.7.1";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-vzaaX3wj1UkFGCohxYlPw6NA0b+oV/2JtpYXC4zncjk=";
+    sha256 = "sha256-oFBOHcrtJe9u/hdW4p8GgIJ2g4oiSNa+qbDFBuMB/HQ=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 852e0a18e91d..fec7fac990cd 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -1,31 +1,23 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
 , attrs, click, cligj, click-plugins, six, munch, enum34
 , pytestCheckHook, boto3, mock, giflib, pytz
 , gdal, certifi
-, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.8.22";
+  version = "1.9.0";
 
   src = fetchPypi {
     pname = "Fiona";
     inherit version;
-    sha256 = "sha256-qCqZzps+eCV0AVfEXJ+yJZ1OkvCohqqsJfDbQP/h7qM=";
+    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
   };
 
-  patches = [
-    # https://github.com/Toblerity/Fiona/pull/1122
-    (fetchpatch {
-      url = "https://github.com/Toblerity/Fiona/commit/fa632130dcd9dfbb982ecaa4911b3fab3459168f.patch";
-      hash = "sha256-IuNHr3yBqS1jY9Swvcq8XPv6BpVlInDx0FVuzEMaYTY=";
-    })
-  ];
-
   CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   nativeBuildInputs = [
+    cython
     gdal # for gdal-config
   ];
 
@@ -62,6 +54,8 @@ buildPythonPackage rec {
     "test_no_append_driver_cannot_append"
   ];
 
+  pythonImportsCheck = [ "fiona" ];
+
   meta = with lib; {
     description = "OGR's neat, nimble, no-nonsense API for Python";
     homepage = "https://fiona.readthedocs.io/";
diff --git a/pkgs/development/python-modules/ghrepo-stats/default.nix b/pkgs/development/python-modules/ghrepo-stats/default.nix
index 71e640cce795..b7f65f9e7843 100644
--- a/pkgs/development/python-modules/ghrepo-stats/default.nix
+++ b/pkgs/development/python-modules/ghrepo-stats/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ghrepo-stats";
-  version = "0.5.0";
+  version = "0.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mrbean-bremen";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-rTW6wADpkP9GglNmQNVecHfA2yJZuzYhJfsLfucbcgY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QHFwIfX0rSVnWgxe82zQXMwIS99CiPgprfoMbuXvXH0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 8e214540b12d..8f75d74f9525 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -1,41 +1,43 @@
 { lib
-, fetchpatch
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
+, fetchpatch
 , swig2
 , openssl
 , typing
+, parameterized
 }:
 
 
 buildPythonPackage rec {
-  version = "0.36.0";
+  version = "0.38.0";
   pname = "M2Crypto";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hadbdckmjzfb8qzbkafypin6sakfx35j2qx0fsivh757s7c2hhm";
+    sha256 = "sha256-mfImCjCQHJSajcbV+CzVMS/7iryS52YzuvIxu7yy3ss=";
   };
 
   patches = [
+    # Use OpenSSL_version_num() instead of unrealiable parsing of .h file.
     (fetchpatch {
-      url = "https://github.com/void-linux/void-packages/raw/7946d12eb3d815e5ecd4578f1a6133d948694370/srcpkgs/python-M2Crypto/patches/libressl.patch";
-      sha256 = "0z5qnkndg6ma5f5qqrid5m95i9kybsr000v3fdy1ab562kf65a27";
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-MR271-opensslversion.patch";
+      hash = "sha256-e1/NHgWza+kum76MUFSofq9Ko3pML67PUfqWjcwIl+A=";
+    })
+    # Changed required to pass tests on OpenSSL 3.0
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests.patch";
+      hash = "sha256-B6JKoPh76+CIna6zmrvFj50DIp3pzg8aKyzz+Q5hqQ0=";
+    })
+    # Allow EVP tests fail on non-FIPS algorithms
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests-evp.patch";
+      hash = "sha256-jMUAphVBQMFaOJSeYUCQMV3WSe9VDQqG6GY5fDQXZnA=";
     })
   ];
-  patchFlags = [ "-p0" ];
 
-  nativeBuildInputs = [ swig2 ];
-  buildInputs = [ swig2 openssl ];
-
-  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
-
-  preConfigure = ''
-    substituteInPlace setup.py --replace "self.openssl = '/usr'" "self.openssl = '${openssl.dev}'"
-  '';
-
-  doCheck = false; # another test that depends on the network.
+  nativeBuildInputs = [ swig2 openssl ];
+  buildInputs = [ openssl parameterized ];
 
   meta = with lib; {
     description = "A Python crypto and SSL toolkit";
@@ -43,5 +45,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ andrew-d ];
   };
-
 }
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 986fa493bf9b..f514791fd0c7 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "0.103.0";
+  version = "1.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-T58RiYZgOWdDXzl2s+BZlQpxvY5BqDFsyK+y2WaKB0E=";
+    hash = "sha256-z2vVGeMB94S/51bB+Tf47ByvP9BWQ1TzQHpFGS8FR8w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/piano-transcription-inference/default.nix b/pkgs/development/python-modules/piano-transcription-inference/default.nix
new file mode 100644
index 000000000000..272f3f6810bf
--- /dev/null
+++ b/pkgs/development/python-modules/piano-transcription-inference/default.nix
@@ -0,0 +1,75 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, fetchurl
+, librosa
+, matplotlib
+, mido
+, torch
+, torchlibrosa
+}:
+
+buildPythonPackage rec {
+  pname = "piano-transcription-inference";
+  version = "0.0.5";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-nbhuSkXuWrekFxwdNHaspuag+3K1cKwq90IpATBpWPY=";
+  };
+
+  checkpoint = fetchurl {
+    name = "piano-transcription-inference.pth";
+    # The download url can be found in
+    # https://github.com/qiuqiangkong/piano_transcription_inference/blob/master/piano_transcription_inference/inference.py
+    url = "https://zenodo.org/record/4034264/files/CRNN_note_F1%3D0.9677_pedal_F1%3D0.9186.pth?download=1";
+    hash = "sha256-w/qXMHJb9Kdi8cFLyAzVmG6s2gGwJvWkolJc1geHYUE=";
+  };
+
+  propagatedBuildInputs = [
+    librosa
+    matplotlib
+    mido
+    torch
+    torchlibrosa
+  ];
+
+  patches = [
+    # Fix run against librosa 0.9.0
+    # https://github.com/qiuqiangkong/piano_transcription_inference/pull/10
+    (fetchpatch {
+      url = "https://github.com/qiuqiangkong/piano_transcription_inference/commit/b2d448916be771cd228f709c23c474942008e3e8.patch";
+      hash = "sha256-8O4VtFij//k3fhcbMRz4J8Iz4AdOPLkuk3UTxuCSy8U=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace piano_transcription_inference/inference.py --replace \
+      "checkpoint_path='{}/piano_transcription_inference_data/note_F1=0.9677_pedal_F1=0.9186.pth'.format(str(Path.home()))" \
+      "checkpoint_path='$out/share/checkpoint.pth'"
+  '';
+
+  postInstall = ''
+    mkdir "$out/share"
+    ln -s "${checkpoint}" "$out/share/checkpoint.pth"
+  '';
+
+  # Project has no tests.
+  # In order to make pythonImportsCheck work, NUMBA_CACHE_DIR env var need to
+  # be set to a writable dir (https://github.com/numba/numba/issues/4032#issuecomment-488102702).
+  # pythonImportsCheck has no pre* hook, use checkPhase to wordaround that.
+  checkPhase = ''
+    export NUMBA_CACHE_DIR="$(mktemp -d)"
+  '';
+  pythonImportsCheck = [ "piano_transcription_inference" ];
+
+  meta = with lib; {
+    description = "A piano transcription inference package";
+    homepage = "https://github.com/qiuqiangkong/piano_transcription_inference";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index 4cc1ad2589ee..446fbfcd9c9e 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.28.0";
+  version = "0.28.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-o5WeqAVg1oGumkQbWeBNJgWgHxz5UOvYpnHt8NviTKA=";
+    hash = "sha256-6gzmVOuJfNpNJlea4Am20HI98mgcKkwtU/28l7qg20Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 7c647293176c..58523a13b066 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4qLfwzJhmcB1CwWTOvgX9qzYSfd2f3WOcXh+Aer1O3I=";
+    hash = "sha256-KV/fkgYUt8hfpGxDO3CNNrC91BaI9W8T2mr2H4eJdxo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/torchlibrosa/default.nix b/pkgs/development/python-modules/torchlibrosa/default.nix
new file mode 100644
index 000000000000..bab73b0dae93
--- /dev/null
+++ b/pkgs/development/python-modules/torchlibrosa/default.nix
@@ -0,0 +1,50 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, librosa
+, numpy
+, torch
+}:
+
+buildPythonPackage rec {
+  pname = "torchlibrosa";
+  version = "0.0.9";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-+LzejKvLlJIIwWm9rYPCWQDSueIwnG5gbkwNE+wbv0A=";
+  };
+
+  propagatedBuildInputs = [
+    librosa
+    numpy
+    torch
+  ];
+
+  patches = [
+    # Fix run against librosa 0.9.0, https://github.com/qiuqiangkong/torchlibrosa/pull/8
+    (fetchpatch {
+      url = "https://github.com/qiuqiangkong/torchlibrosa/commit/eec7e7559a47d0ef0017322aee29a31dad0572d5.patch";
+      hash = "sha256-c1x3MA14Plm7+lVuqiuLWgSY6FW615qnKbcWAfbrcas=";
+    })
+  ];
+
+  # Project has no tests.
+  # In order to make pythonImportsCheck work, NUMBA_CACHE_DIR env var need to
+  # be set to a writable dir (https://github.com/numba/numba/issues/4032#issuecomment-488102702).
+  # pythonImportsCheck has no pre* hook, use checkPhase to workaround that.
+  checkPhase = ''
+    export NUMBA_CACHE_DIR="$(mktemp -d)"
+  '';
+  pythonImportsCheck = [ "torchlibrosa" ];
+
+  meta = with lib; {
+    description = "PyTorch implemention of part of librosa functions";
+    homepage = "https://github.com/qiuqiangkong/torchlibrosa";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/development/tools/biodiff/default.nix b/pkgs/development/tools/biodiff/default.nix
index 839f7b1b6ccc..610b991ec52a 100644
--- a/pkgs/development/tools/biodiff/default.nix
+++ b/pkgs/development/tools/biodiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biodiff";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "8051Enthusiast";
     repo = "biodiff";
     rev = "v${version}";
-    sha256 = "sha256-ZIZ6XpRuqhacpvi1kf7zvMszzbF8IvWrMlxAZnJJSxE=";
+    sha256 = "sha256-anGiqTiZVm6q8BII1Ahg2ph7OwX5isCa16orEcf4aFE=";
   };
 
-  cargoSha256 = "sha256-/LrrHK9j6xg3J56ubM9RdkJeMn4nvpddUGMtHu2s6OE=";
+  cargoSha256 = "sha256-uyATu6M04IRFtzFb2ox0xUYFXjkW+t+71Iy58TuqCko=";
 
   meta = with lib; {
     description = "Hex diff viewer using alignment algorithms from biology";
diff --git a/pkgs/development/tools/ddosify/default.nix b/pkgs/development/tools/ddosify/default.nix
index e0d03e7f890b..65e6dd4b2a8c 100644
--- a/pkgs/development/tools/ddosify/default.nix
+++ b/pkgs/development/tools/ddosify/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddosify";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tw6rrhFhuIsVAj5IqSHGHSYheDqGENLDxiJr+PQno1U=";
+    sha256 = "sha256-bS/7S4PxZSTYvxLFmC486PBHNhkGUIPAnUJQztp3ouw=";
   };
 
   vendorHash = "sha256-3y5ppTtvGqwWhgnVBpP4gf26DHKPnSNYK4jfhBiYDwY=";
diff --git a/pkgs/development/tools/ttfb/default.nix b/pkgs/development/tools/ttfb/default.nix
new file mode 100644
index 000000000000..a3b8898eacf4
--- /dev/null
+++ b/pkgs/development/tools/ttfb/default.nix
@@ -0,0 +1,45 @@
+{ darwin
+, fetchCrate
+, lib
+, openssl
+, pkg-config
+, rustPlatform
+, stdenv
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ttfb";
+  version = "1.6.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-o7kzQ8jtAqDwTUPtjeNqgotxREeWl7jQG+EDrYWJL/Q=";
+  };
+
+  cargoSha256 = "sha256-ayyYrrFDVOYVjVo5TLaRn2mvmywe5BjQ7kRVV2r0iK8=";
+
+  # The bin feature activates all dependencies of the binary. Otherwise,
+  # only the library is build.
+  buildFeatures = [ "bin" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with lib; {
+    description = "CLI-Tool to measure the TTFB (time to first byte) of HTTP(S) requests";
+    longDescription = ''
+      This crate measures the times of DNS lookup, TCP connect, TLS handshake, and HTTP's TTFB
+      for a given IP or domain.
+    '';
+    homepage = "https://github.com/phip1611/ttfb";
+    changelog = "https://github.com/phip1611/ttfb/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ phip1611 ];
+  };
+}
+
diff --git a/pkgs/development/tools/zprint/default.nix b/pkgs/development/tools/zprint/default.nix
index c401ecf0bb52..f93098aebfe2 100644
--- a/pkgs/development/tools/zprint/default.nix
+++ b/pkgs/development/tools/zprint/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "zprint";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "https://github.com/kkinnear/${pname}/releases/download/${version}/${pname}-filter-${version}";
-    sha256 = "sha256-PgmaKxTOZPgHhEfFA5FdHrKHHpfieoK2QZBYR3f0J8s=";
+    sha256 = "sha256-PWdR5jqyzvTk9HoxqDldwtZNik34dmebBtZZ5vtva4A=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 7454242c72b5..e3385eaca537 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.11.1";
+  version = "5.12.0";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-2Sjl9XO01ko0BwbFQSFv9mNoetyMa8Dxx17y0JmlLS0=";
+    sha256 = "sha256-ep48Lgxw0yKd7+Cx6wMEnOqu/1vjdCM36+TKv1sb1Tk=";
   };
 
   postPatch = ''
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index 76dac1e5e278..b036ded0b74c 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.4.3";
+  version = "4.4.6";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-oPZdQEfWgVo4M0WDhKfDDB4GqnzQEM8x79FSa3jC+U0=";
+    sha256 = "sha256-I4EKYoN+36a65mcZ2UWH3Ws75Ojdmpw/6flKFmEuIk8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 01eeb6fcb1aa..6dde194f92ea 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-w9je2dcVMDhUCG2zK9uQWpTXQh3zw+0yL/qVrl3DqzE=";
-    arm64-linux_hash = "sha256-j5pxMTLE2Mk91q76Y1n8j3pG/1aPrGkkvSjzAI8nJro=";
-    x64-osx_hash = "sha256-ILz3zNQNUwFGMLvz4sqZMzsN+tw/HNpr5mFLSIKQ4Gg=";
+    x64-linux_hash = "sha256-0JeZaHaAJ0Z+wcEPGA8yidiKsU/lxEgC6BGpFEzjO0A=";
+    arm64-linux_hash = "sha256-/N8SY0JS3yX2MARb7MN68CWEZQ8mIXM5zmg96r8hVsw=";
+    x64-osx_hash = "sha256-kcD6ATOGYJULk6g+v4uISDtnzr0c1y2BntIt3MWUR0Q=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "1.1.1.2377";
+  version = "1.1.2.2453";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index f1ff08b930cf..067f9b48d58e 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1193";
+  version = "2.0-1202";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-yvM4mEFBelT8Nox0vzI4tlQbxDUkoMAB6q8l5LW8+b4=";
+    hash = "sha256-YeBzXnw/BpJDUJ7fUf7TH0zQcpCjUm9peB7zPO2ZsYI=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/web-apps/wallabag/default.nix b/pkgs/servers/web-apps/wallabag/default.nix
index 955eac2c6c33..4fb9c43380da 100644
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "wallabag";
-  version = "2.5.2";
+  version = "2.5.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
       "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"
       "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz"
     ];
-    hash = "sha256-Q989SorGPm3KBuQhGAinYU6HGIa9RrhtRPvwGALU6jk=";
+    hash = "sha256-a30z9rdXcfc2eVuShEobgDWWHr9TfMwq9WwaWdrI3QU=";
   };
 
   patches = [
@@ -45,8 +45,12 @@ stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir $out
     cp -R * $out/
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index 9615b57e0c1a..5503e9eb38e0 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glmark2";
-  version = "2021.12";
+  version = "2023.01";
 
   src = fetchFromGitHub {
     owner = "glmark2";
     repo = "glmark2";
     rev = version;
-    sha256 = "sha256-S6KkazkG+kdx02MPwrYvCFWSOtM6t5xT0OTE9PLCzas=";
+    sha256 = "sha256-WCvc5GqrAdpIKQ4LVqwO6ZGbzBgLCl49NxiGJynIjSQ=";
   };
 
   nativeBuildInputs = [ pkg-config wafHook makeWrapper ];
diff --git a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
index f20e2899f185..bb974fbc8b58 100644
--- a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
+++ b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, buildPackages, libiconv, skktools }:
+{ lib, stdenv, fetchurl, buildPackages, iconv, skktools }:
 
 let
   # kana to kanji
@@ -25,15 +25,13 @@ let
     url = "https://raw.githubusercontent.com/skk-dev/dict/8b35d07a7d2044d48b063d2774d9f9d00bb7cb48/SKK-JISYO.assoc";
     sha256 = "1smcbyv6srrhnpl7ic9nqds9nz3g2dgqngmhzkrdlwmvcpvakp1v";
   };
-
-  iconvBin = if stdenv.isDarwin then libiconv else  buildPackages.stdenv.cc.libc;
 in
 
 stdenv.mkDerivation {
   pname = "skk-dicts-unstable";
   version = "2020-03-24";
   srcs = [ small medium large edict assoc ];
-  nativeBuildInputs = [ skktools ] ++ lib.optional stdenv.isDarwin libiconv;
+  nativeBuildInputs = [ iconv skktools ];
 
   strictDeps = true;
 
@@ -51,8 +49,7 @@ stdenv.mkDerivation {
     for src in $srcs; do
       dst=$out/share/$(dictname $src)
       echo ";;; -*- coding: utf-8 -*-" > $dst  # libskk requires this on the first line
-      ${lib.getBin iconvBin}/bin/iconv \
-        -f EUC-JP -t UTF-8 $src | skkdic-expr2 >> $dst
+      iconv -f EUC-JP -t UTF-8 $src | skkdic-expr2 >> $dst
     done
 
     # combine .L .edict and .assoc for convenience
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 6a039698369b..267272b0b664 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wimboot";
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "wimboot";
     rev = "v${version}";
-    sha256 = "sha256-LaPH6nGQanweAG0niS75hr7zbO/9A3iZjS8wHD//oJ4=";
+    sha256 = "sha256-rbJONP3ge+2+WzCIpTUZeieQz9Q/MZfEUmQVbZ+9Dro=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 5fade3f201b6..bf2587d8c658 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tgt";
-  version = "1.0.84";
+  version = "1.0.85";
 
   src = fetchFromGitHub {
     owner = "fujita";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NlEEakmut4WMI+mpm+SJOgHmWELRcl/dZJspks3VoqY=";
+    sha256 = "sha256-hjP+1uBcUfIFdRd0gbZXR+VsAF+6QrvV3//GrQhOKWc=";
   };
 
   nativeBuildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index 51aefd496c55..f03a1a17171a 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HLBW7a2sjA/bs8VJkwQNqM6YPEfa1onMoK89G5Fsb8s=";
+    hash = "sha256-TV2knPG5n5l8APeAmpDfu6vQLtEhjqH21JXAZLk0DDI=";
   };
 
   vendorHash = "sha256-xMHlooXuLECQi7co2/WvY0TIoV0S5OgcBklICCFk3ls=";
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index ea3f03161dbb..0d72541afe28 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.60";
+  version = "1.0.61";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6p9hLbU5ZaA4o6PRyfSt/gb3D3XeeWacJ2LlpJ0+w18=";
+    sha256 = "sha256-BAUvqRgcHVVFuTNX9W0PiYF3f1yd2mJxmE7It9as4gs=";
   };
 
-  cargoHash = "sha256-COWvEfFQMi3ltQSEFK3S6y07YLqqtjAf2H4p0TX/U70=";
+  cargoHash = "sha256-baQP9GEkZx5dSm64GpQ0h5SKQUzZALyplRUKEKX0K8U=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/systeroid/default.nix b/pkgs/tools/system/systeroid/default.nix
index 4fd26b5d487c..88b19d1b92b5 100644
--- a/pkgs/tools/system/systeroid/default.nix
+++ b/pkgs/tools/system/systeroid/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systeroid";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VkkobNYkz8FunyaS6EJpfqOvDdwZJE+P2YTSJCgHZI0=";
+    sha256 = "sha256-uQa6n8DESnpO9xzfExywY6lG3nZkNSpjgEm5b+ayc8I=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"/usr/share/doc/kernel-doc-*/Documentation/*",' '"${linux-doc}/share/doc/linux-doc/*",'
   '';
 
-  cargoSha256 = "sha256-ulmU33j2edzMA/L4KXiM5M6RhH3MmMAkA2DuHxdj2uk=";
+  cargoHash = "sha256-baxXSjbS/5i9xnQGdPYPqgu0c2HGEAU7j7X8wtKSznA=";
 
   buildInputs = [
     xorg.libxcb
diff --git a/pkgs/tools/text/cmigemo/default.nix b/pkgs/tools/text/cmigemo/default.nix
index 1f9ef7701ba1..7b2598a9cfb2 100644
--- a/pkgs/tools/text/cmigemo/default.nix
+++ b/pkgs/tools/text/cmigemo/default.nix
@@ -1,11 +1,8 @@
 { lib, stdenv, fetchFromGitHub, buildPackages
-, libiconv, nkf, perl, which
+, iconv, nkf, perl, which
 , skk-dicts
 }:
 
-let
-  iconvBin = if stdenv.isDarwin then libiconv else  buildPackages.stdenv.cc.libc;
-in
 stdenv.mkDerivation {
   pname = "cmigemo";
   version = "1.3e";
@@ -17,7 +14,7 @@ stdenv.mkDerivation {
     sha256 = "00a6kdmxp16b8x0p04ws050y39qspd1bqlfq74bkirc55b77a2m1";
   };
 
-  nativeBuildInputs = [ libiconv nkf perl which ];
+  nativeBuildInputs = [ iconv nkf perl which ];
 
   postUnpack = ''
     cp ${skk-dicts}/share/SKK-JISYO.L source/dict/
@@ -27,10 +24,6 @@ stdenv.mkDerivation {
 
   makeFlags = [ "INSTALL=install" ];
 
-  preBuild = ''
-    makeFlagsArray+=(FILTER_UTF8="${lib.getBin iconvBin}/bin/iconv -t utf-8 -f cp932")
-  '';
-
   buildFlags = [ (if stdenv.isDarwin then "osx-all" else "gcc-all") ];
 
   installTargets = [ (if stdenv.isDarwin then "osx-install" else "gcc-install") ];
diff --git a/pkgs/tools/text/mark/default.nix b/pkgs/tools/text/mark/default.nix
index dfff4ffefe85..af084b4aa190 100644
--- a/pkgs/tools/text/mark/default.nix
+++ b/pkgs/tools/text/mark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mark";
-  version = "8.6";
+  version = "8.7";
 
   src = fetchFromGitHub {
     owner  = "kovetskiy";
     repo   = "mark";
     rev    = version;
-    sha256 = "sha256-2HcCibcP3/E3nu+PoNFChLFyCwAeAdp6I8mN95747Sg=";
+    sha256 = "sha256-A6EfP7l95eg9uL6NDqiPSzQ59JmTdE96UqunHETns9M=";
   };
 
-  vendorHash = "sha256-t2xiw1Z0BIT7pO4Z16XmsJE72RgL9Hobfy7LakpEYh4=";
+  vendorHash = "sha256-LJ288Z8xz/Xoy5I2OAk9v5hxRUkQcRTmNaQ31kHE8gQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index e9293d33b3ee..b6ee1d60a82b 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "3.9.6";
+  version = "3.9.7";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BzYlZl4NYjCXaM9ISGKSEP2xGFsE5GgX4zEIDniundo=";
+    hash = "sha256-y6P0EQfp2HFmhn2c7RwX8jVLUOfLT+LVhtz+OIoaVSo=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/wayland/swayimg/default.nix b/pkgs/tools/wayland/swayimg/default.nix
index 24f44fa8d336..f3ba661e91f5 100644
--- a/pkgs/tools/wayland/swayimg/default.nix
+++ b/pkgs/tools/wayland/swayimg/default.nix
@@ -22,13 +22,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "swayimg";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-864riSvWhWV4X84UeZ+xfQBOAQmwMrX6s90TXMGeruY=";
+    sha256 = "sha256-Iq7T00hvr9Mv50V/GKJBddjoeHdFa2DneVaXyxhMCE0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e8c53dfdf823..e7331e6549c4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2171,7 +2171,7 @@ with pkgs;
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
 
-  ppsspp = callPackage ../applications/emulators/ppsspp { };
+  ppsspp = libsForQt5.callPackage ../applications/emulators/ppsspp { };
 
   ppsspp-sdl = ppsspp;
 
@@ -2181,7 +2181,6 @@ with pkgs;
   };
 
   ppsspp-qt = ppsspp.override {
-    inherit (libsForQt5) qtbase qtmultimedia wrapQtAppsHook;
     enableQt = true;
     enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/11628
   };
@@ -7604,11 +7603,8 @@ with pkgs;
 
   gitkraken = callPackage ../applications/version-management/gitkraken { };
 
-  gitlab = callPackage ../applications/version-management/gitlab {
-    openssl = openssl_1_1;
-  };
+  gitlab = callPackage ../applications/version-management/gitlab { };
   gitlab-ee = callPackage ../applications/version-management/gitlab {
-    openssl = openssl_1_1;
     gitlabEnterprise = true;
   };
 
@@ -12736,6 +12732,8 @@ with pkgs;
 
   oysttyer = callPackage ../applications/networking/instant-messengers/oysttyer { };
 
+  ttfb = callPackage ../development/tools/ttfb { };
+
   twilight = callPackage ../tools/graphics/twilight {
     libX11 = xorg.libX11;
   };
@@ -16536,7 +16534,7 @@ with pkgs;
     bluezSupport = true;
     x11Support = true;
   };
-  python311Full = python310.override {
+  python311Full = python311.override {
     self = python311Full;
     pythonAttr = "python311Full";
     bluezSupport = true;
@@ -21305,6 +21303,14 @@ with pkgs;
 
   libiconvReal = callPackage ../development/libraries/libiconv { };
 
+  iconv =
+    if lib.elem stdenv.hostPlatform.libc [ "glibc" "musl" ] then
+      lib.getBin stdenv.cc.libc
+    else if stdenv.hostPlatform.isDarwin then
+      lib.getBin darwin.libiconv
+    else
+      lib.getBin libiconvReal;
+
   # On non-GNU systems we need GNU Gettext for libintl.
   libintl = if stdenv.hostPlatform.libc != "glibc" then gettext else null;
 
@@ -27708,6 +27714,8 @@ with pkgs;
 
   roboto-mono = callPackage ../data/fonts/roboto-mono { };
 
+  roboto-serif = callPackage ../data/fonts/roboto-serif { };
+
   roboto-slab = callPackage ../data/fonts/roboto-slab { };
 
   hasklig = callPackage ../data/fonts/hasklig {};
@@ -32057,6 +32065,8 @@ with pkgs;
 
   pianoteq = callPackage ../applications/audio/pianoteq { };
 
+  pianotrans = callPackage ../applications/audio/pianotrans { };
+
   picard = callPackage ../applications/audio/picard { };
 
   picocom = callPackage ../tools/misc/picocom {
diff --git a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
index 1e53a02ec8a9..37687117987d 100644
--- a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
+++ b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
@@ -42,4 +42,4 @@ let
     else testers.hasPkgConfigModule { inherit moduleName; package = pkg; };
 
 in
-  allTests // { inherit tests-combined; }
+  lib.recurseIntoAttrs allTests // { inherit tests-combined; }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index be3ea429793e..e5c736238d18 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5584,10 +5584,7 @@ self: super: with self; {
 
   lzstring = callPackage ../development/python-modules/lzstring { };
 
-  m2crypto = callPackage ../development/python-modules/m2crypto {
-    # https://gitlab.com/m2crypto/m2crypto/-/issues/310
-    openssl = pkgs.openssl_1_1;
-  };
+  m2crypto = callPackage ../development/python-modules/m2crypto { };
 
   m2r = callPackage ../development/python-modules/m2r { };
 
@@ -7069,6 +7066,8 @@ self: super: with self; {
 
   pi1wire = callPackage ../development/python-modules/pi1wire { };
 
+  piano-transcription-inference = callPackage ../development/python-modules/piano-transcription-inference { };
+
   piccata = callPackage ../development/python-modules/piccata { };
 
   pick = callPackage ../development/python-modules/pick { };
@@ -11531,6 +11530,8 @@ self: super: with self; {
 
   torchinfo = callPackage ../development/python-modules/torchinfo { };
 
+  torchlibrosa = callPackage ../development/python-modules/torchlibrosa { };
+
   torchvision = callPackage ../development/python-modules/torchvision { };
 
   torchvision-bin = callPackage ../development/python-modules/torchvision/bin.nix { };